feat: use postgres

authsession/docs/runtime.md

@@ -101,7 +101,8 @@ gateway-facing projection namespaces as a derived integration view.
 
 Required for all process starts:
 
-- `AUTHSESSION_REDIS_ADDR`
+- `AUTHSESSION_REDIS_MASTER_ADDR`
+- `AUTHSESSION_REDIS_PASSWORD`
 
 Core process config:
 
@@ -124,13 +125,23 @@ Internal HTTP config:
 - `AUTHSESSION_INTERNAL_HTTP_IDLE_TIMEOUT`
 - `AUTHSESSION_INTERNAL_HTTP_REQUEST_TIMEOUT`
 
-Redis connectivity and namespace config:
+Redis connection topology (managed by `pkg/redisconn`,
+see `ARCHITECTURE.md §Persistence Backends`):
 
-- `AUTHSESSION_REDIS_USERNAME`
-- `AUTHSESSION_REDIS_PASSWORD`
+- `AUTHSESSION_REDIS_MASTER_ADDR` (required)
+- `AUTHSESSION_REDIS_REPLICA_ADDRS` (optional, comma-separated; reserved for
+  future read-routing — currently unused)
+- `AUTHSESSION_REDIS_PASSWORD` (required)
 - `AUTHSESSION_REDIS_DB`
-- `AUTHSESSION_REDIS_TLS_ENABLED`
 - `AUTHSESSION_REDIS_OPERATION_TIMEOUT`
+
+> Removed: `AUTHSESSION_REDIS_ADDR`, `AUTHSESSION_REDIS_USERNAME`,
+> `AUTHSESSION_REDIS_TLS_ENABLED`. `pkg/redisconn.LoadFromEnv` rejects the
+> deprecated `*_REDIS_TLS_ENABLED` and `*_REDIS_USERNAME` variables at
+> startup; see `docs/redis-config.md` for the rationale.
+
+Redis namespace and stream config:
+
 - `AUTHSESSION_REDIS_CHALLENGE_KEY_PREFIX`
 - `AUTHSESSION_REDIS_SESSION_KEY_PREFIX`
 - `AUTHSESSION_REDIS_USER_SESSIONS_KEY_PREFIX`